Recently, there is a need to access intranet of my company from another intranet via OpenVPN. As you know, I am not a fan of clicking connect on my computer every time I need to visit a resource on the other side, I decide to deploy it on my router.If you happen to have a Gee Go router, it already has the OpenVPN built in. Follow the guide and you're ready to go. Otherwise, you need to install and configure it yourself just like I did.The first thing you need to do is root your router. You can either root it via official developer mode (with the cost of losing your warranty) or install a custom plugin by registering as a developer~Now you rooted your router. SSH into it and edit /etc/opkg.conf. Addarch all 100 arch ramips 200 arch ramips_24kec 300at the end of the file and do opkg update. Failed or not is not important, you just need to ensure it is completed.Download OpenVPN ipk from https://archive.openwrt.org/barrier_breaker/14.07/ramips/mt7620a/packages/base/ try openvpn-openssl first, then openvpn-polarssl, since the openssl version has better compatibility and performance.Install with command opkg install xxxxx.ipk. It will download and install dependencies automatically.Upload your OpenVPN config to anywhere you like. It's "/root/vpn/demo.ovpn" in my case.Try to connect with command openvpn --cd /ovpn/path --config /config/full/path. Correct all problems if there is any. If your key file needs password, you can decrypt it with openssl as following:$ openssl rsa -in neo.key -out nopassword.key Enter pass phrase for neo.key: writing RSA keyNow you can connect to your company intranet within the router shell, but not any device connected to the router. You need iptables to route it through the router.Try the following rules if it works and tweak it as you need.#!/bin/sh iptables -I FORWARD -o tun0 -j ACCEPT iptables -t nat -I POSTROUTING -s local.CIDR/24 -d remote.CIDR/24 -o tun0 -j MASQUERADEIf you have multiple IP ranges to visit, append new iptables command to the script.Once you made the script working, save it as up.sh.Write a script to remove all above rules and save it as down.sh. In my case, it is:#!/bin/sh iptables -D FORWARD -o tun0 -j ACCEPT iptables -t nat -D POSTROUTING -s source.CIDR/24 -d remote.CIDR/24 -o tun0 -j MASQUERADEAppend command to your ovpn file (you have to run openvpn as root after scripts are used)script-security 2 up ./up.sh down ./down.shEdit OpenVPN config located at /etc/config/openvpn. Remove all the content and write downpackage openvpn config openvpn custom_config option enabled 1 option config /path/to/your/ovpn/configRun the openvpn command again to give it a final test. Check if iptables rules exist and everything is working well.Run /etc/init.d/openvpn start to see if the daemon works.Run /etc/init.d/openvpn enable to enable autorun on boot.Enjoy.
How to flash your K3 router with custom Merlin firmware
The PHICOMM routers are kind of, you know, sucks with stock firmware and nobody knows if there are any backdoors or malware hidden in it. Plus, the stock firmware is lack of 3rd party software support as well as some scientific plugins to browse the internet freely. The best solution so far to flash the router with custom firmware. Among which, Merlin is probably the best choice.Ok, I assume you've already got your K3 route at hand, and let's get started.Download the files listed in the link at the bottom of the article and unzip them.Download tftpd from the internet and put it in the same folder with all the ROM files.Change your ethernet IP to 192.168.2.2 and connect your computer to the router by cable.Power on your router and wait for it fully boot up. You can check it by browsing to the admin page http://192.168.2.1Run RouteAckPro.exe and click "Enable telnet". You'll receive a message saying acknowledge received. This way, you enabled the hidden telnet feature of the stock firmware. Since the latest K3 is shipped with a new version of Broadcom CFE, the CFE way of flashing ROM without verification is no longer available anymore.Telnet 192.168.2.1 to enter command line mode and run the following command:cd /tmp tftp -g -r k3_root.bin 192.168.2.2 cat k3_root.bin >/dev/mtdblock6 && reboot The router will reboot automatically and you'll see a system is being updated message on the screen. Wait until the router fully booted and enter the admin page at http://192.168.2.1 set a password (anything you like) and reboot.Use any ssh client to log into your router by using username admin and the password you set in the previous step.Type the following command:cd /tmp tftp -g -r K3_Melin_12.06.trx 192.168.2.2 cat K3_Melin_12.06.trx >/dev/mtdblock6 && reboot The router will reboot automatically as usual. But this time you should change your ethernet IP setting back to DHCP to get an IP from the router 'cause Merlin uses a different IP pool from openwrt.You're ready to play with Merlin now. Do remember to do a factory reset before use, it can keep you away from many mysterious problems.Enjoy.All files can be found here: LINKCredit: tianbaoha@right.com.cn, laode1987@right.com.cn